CKA Workloads and Scheduling Practice Test 2 — 15 Questions

Question 1

A Deployment named 'web-app' is configured with rolling update strategy. You run 'kubectl describe deployment web-app' and see 'RollingUpdateStrategy: 25% max unavailable, 25% max surge'. You have 4 replicas. You update the image. How many pods will be unavailable during the rollout at most?

Accepted Answer

1. With a rolling update strategy of 25% max unavailable and 25% max surge on a Deployment with 4 replicas, the maximum number of pods that can be unavailable during the rollout is 1. This is because 25% of 4 replicas equals 1, and Kubernetes rounds down for max unavailable, ensuring at least 3 pods remain available throughout the update.

Answer

0

Answer

4

Answer

2

Question 2

You have a DaemonSet that runs a logging agent. You want to ensure it only runs on nodes with GPU. Which field should you set in the DaemonSet's pod template spec?

Accepted Answer

spec.template.spec.nodeSelector. Option B is correct because `spec.template.spec.nodeSelector` is a simple, direct field in the Pod template spec that constrains which nodes the DaemonSet's pods can be scheduled on. By setting a key-value pair like `gpu: true`, you ensure the logging agent only runs on nodes that have that label, which is the standard Kubernetes mechanism for node-level selection without complex expressions.

Answer

spec.selector

Answer

spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

Answer

spec.template.spec.nodeName

Question 3

Which kubectl command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. Option D is correct because `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' using the contents of the file 'config.properties'. The `--from-file` flag reads the file as-is and stores its content under a key that defaults to the filename (config.properties). This is the standard method for creating a ConfigMap from a single file.

Answer

kubectl apply configmap app-config config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 4

A StatefulSet named 'db' has 3 replicas. You need to update the pod template to change the resource limits. After applying the change, you run 'kubectl rollout status sts db' and it hangs. What is the most likely reason?

Accepted Answer

The StatefulSet's pod management policy is OrderedReady, and the first pod to update (db-2) is not becoming Ready.. Option B is correct because StatefulSets with the default OrderedReady pod management policy update pods sequentially in reverse order (from highest ordinal to lowest). When `kubectl rollout status sts db` hangs, it indicates that the update is stuck waiting for the first pod in the update sequence (db-2) to become Ready. If db-2 fails to become Ready due to the new resource limits (e.g., insufficient cluster resources or misconfigured limits), the rollout cannot proceed to update db-1 and db-0, causing the command to hang indefinitely.

Answer

The update strategy is set to OnDelete, and you need to delete pods manually.

Answer

The maxSurge setting is preventing the update from starting.

Answer

The StatefulSet's service name is incorrect, causing DNS resolution failures.

Question 5

You have a CronJob that runs a backup job every 5 minutes. The job takes about 2 minutes to complete. You notice that sometimes two job pods are running simultaneously. What is the most likely cause?

Accepted Answer

The concurrencyPolicy is set to 'Allow' (default) which permits overlapping executions.. Option B is correct because the default `concurrencyPolicy` for a CronJob is `Allow`, which permits new Job pods to start even if a previous Job is still running. Since the backup takes 2 minutes and the CronJob runs every 5 minutes, overlapping executions should not normally occur unless the Job duration exceeds the interval. However, if the `concurrencyPolicy` is set to `Allow`, the CronJob controller will create a new Job pod regardless of whether the previous one is still running, leading to simultaneous pods. The most likely cause is that the `concurrencyPolicy` is explicitly or implicitly set to `Allow`, allowing overlapping executions.

Answer

The backup takes longer than expected due to data volume.

Answer

The job's parallelism is set to 2.

Answer

The CronJob's startingDeadlineSeconds is set too low.

Question 6

A pod with priorityClassName: high is pending. You describe the pod and see the event: '0/3 nodes are available: 3 node(s) didn't match pod affinity/anti-affinity, 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate.' The pod has required anti-affinity to avoid co-location with pods from the same app. How can you get the pod scheduled?

Accepted Answer

Change the anti-affinity rule from requiredDuringSchedulingIgnoredDuringExecution to preferredDuringSchedulingIgnoredDuringExecution.. The pod is pending because its required anti-affinity rule cannot be satisfied on any node: all 3 nodes either have a control-plane taint (which the pod doesn't tolerate) or already host pods from the same app, violating the anti-affinity. Changing the rule from requiredDuringSchedulingIgnoredDuringExecution to preferredDuringSchedulingIgnoredDuringExecution makes the anti-affinity a soft constraint, allowing the scheduler to place the pod on a node even if it means co-locating with same-app pods, thus resolving the scheduling conflict.

Answer

Add a toleration for the control-plane taint.

Answer

Increase the number of replicas of the app to spread the pods.

Answer

Delete the existing pods of the same app to free up nodes.

Question 7

You have a Pod that needs to run a database migration before the main application container starts. Which Kubernetes concept should you use?

Accepted Answer

Init container. Init containers are designed to run to completion before the main application containers start, making them the ideal Kubernetes primitive for tasks like database migrations that must complete before the primary service begins. Unlike sidecars, init containers do not run concurrently with the main container, ensuring the migration finishes before the application container starts.

Answer

Sidecar container

Answer

PostStart hook

Answer

Job

Question 8

You need to implement a PriorityClass named 'high-priority' with value 1000 and mark it as non-preempting. Which YAML field should you set to true?

Accepted Answer

spec.preemptionPolicy: Never. Option A is correct because setting `spec.preemptionPolicy: Never` in a PriorityClass definition marks it as non-preempting, meaning pods with this priority will not preempt lower-priority pods even if they have a higher priority value. This field is the only one that controls preemption behavior for a PriorityClass.

Answer

spec.description: "non-preempting"

Answer

spec.globalDefault: true

Answer

spec.value: 1000

Question 9

A HorizontalPodAutoscaler (HPA) is configured for a Deployment with 5 replicas. The HPA is using average CPU utilization, target 50%. You observe that the actual CPU usage is 40% and the HPA does not scale down. What is the most likely reason?

Accepted Answer

The HPA's downscale stabilization window is preventing immediate scale down.. The HPA's default behavior includes a downscale stabilization window (specified by the `--horizontal-pod-autoscaler-downscale-stabilization` flag, defaulting to 5 minutes). This window prevents rapid flapping by requiring the desired replica count to remain stable for the duration of the window before a scale-down is executed. Since the actual CPU usage (40%) is below the target (50%), the HPA would normally calculate a lower desired replica count, but the stabilization window delays the actual scale-down action.

Answer

The HPA is using the wrong metric.

Answer

The Deployment's rolling update is in progress.

Answer

The HPA's minReplicas is set to 5.

Question 10

Which of the following is a valid way to mount a Secret as a volume in a Pod?

Accepted Answer

volumes:
- name: secret-volume
  secret:
    secretName: my-secret. Option A is correct because it uses the `secret` volume type with the `secretName` field to reference a Kubernetes Secret object. This is the standard syntax for mounting a Secret as a volume in a Pod, allowing the Secret's data to be exposed as files in the container's filesystem.

Answer

volumes:
- name: secret-volume
  secretName: my-secret

Answer

volumes:
- name: secret-volume
  configMap:
    name: my-secret

Answer

volumes:
- name: secret-volume
  hostPath:
    path: /etc/secret

Question 11

What is the default pod phase when a pod is first created but not yet running?

Accepted Answer

Pending. When a Pod is first created, it enters the Pending phase before it is scheduled onto a node and its containers are started. The Pending phase indicates that the Pod has been accepted by the Kubernetes API server but one or more containers are not yet running, often because the image is being pulled or the node is not ready. This is the default initial phase as defined in the Kubernetes Pod lifecycle.

Answer

Running

Answer

Succeeded

Answer

Unknown

Question 12

You have a Deployment with 3 replicas. You run 'kubectl rollout history deployment web-app' and see revision 2 is current. You want to roll back to revision 1. Which command should you use?

Accepted Answer

kubectl rollout undo deployment/web-app --to-revision=1. Option C is correct because `kubectl rollout undo deployment/web-app --to-revision=1` explicitly rolls back the Deployment to revision 1, which is the desired state. The `--to-revision` flag targets a specific revision from the rollout history, ensuring the Deployment's Pod template is reverted to the exact configuration of revision 1.

Answer

kubectl set image deployment/web-app web-app=image:v1

Answer

kubectl rollout history deployment/web-app --revision=1

Answer

kubectl rollout undo deployment/web-app

Question 13

Which TWO statements about Kubernetes resource requests and limits are correct? (Select 2)

Accepted Answer

Limits can be set independently for CPU and memory.. Option A is correct because Kubernetes allows CPU and memory limits to be set independently via the `resources.limits` field in a container spec. CPU limits are defined in millicores (e.g., 500m) and memory limits in bytes (e.g., 256Mi), and they are not coupled — you can set a CPU limit without a memory limit and vice versa. This independence gives administrators fine-grained control over resource allocation per container.

Answer

Memory requests and limits are both compressible.

Answer

If a container exceeds its memory limit, it is throttled.

Answer

If no limits are specified, the pod can use unlimited resources.

Question 14

Which THREE of the following are valid taint effects that can be applied to a node? (Select 3)

Accepted Answer

NoSchedule. Taint effects in Kubernetes control pod scheduling onto nodes. `NoSchedule` (C) prevents pods that do not tolerate the taint from being scheduled on the node, making it a valid taint effect.

Answer

NeverSchedule

Answer

PreferSchedule

Question 15

Which TWO statements about DaemonSets are correct? (Select 2)

Accepted Answer

DaemonSets are often used for cluster daemons like log collectors or monitoring agents.. Option C is correct because DaemonSets are specifically designed to run cluster-wide services such as log collectors (e.g., Fluentd) or monitoring agents (e.g., Prometheus Node Exporter). They automatically deploy a pod on every node (or a subset of nodes based on node selectors), ensuring that each node has a copy of the daemon pod for tasks like log aggregation or metrics collection.

Answer

DaemonSets are typically managed by a parent Deployment.

Answer

DaemonSets do not support rolling updates.

Answer

DaemonSets have a desired number of replicas that the scheduler tries to maintain.